Full Report
[Control Systems] Siemens security advisory (AV26-881)
Analysis Summary
# Vulnerability: Account Hijacking in Mendix SAML Module
## CVE Details
- **CVE ID:** CVE-2024-41957
- **CVSS Score:** 9.6 (Critical)
- **CWE:** CWE-287 (Improper Authentication)
## Affected Systems
- **Products:** Mendix SAML Module
- **Versions:**
- Mendix 10 compatible: All versions prior to V4.2.3
- Mendix 11 compatible: All versions prior to V4.2.3
- Mendix 9.24 compatible: All versions prior to V3.6.27
- **Configurations:** Systems utilizing the Mendix SAML module for user authentication via Single Sign-On (SSO).
## Vulnerability Description
The Mendix SAML module contains a critical flaw in its authentication logic. Due to improper validation of SAML assertions, an unauthenticated remote attacker can bypass authentication mechanisms. By crafting specific SAML responses, the attacker can impersonate any existing user, including those with administrative privileges, leading to full account takeover.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; PoC not publicly detailed in this advisory.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to user data)
- **Integrity:** High (Ability to modify data and configurations)
- **Availability:** High (Ability to delete data or lock out legitimate users)
## Remediation
### Patches
Siemens has released updates for the Mendix SAML module. Users are urged to update to the following versions via the Mendix Marketplace:
- **Mendix 10 & 11 compatible:** Update to V4.2.3 or later.
- **Mendix 9.24 compatible:** Update to V3.6.27 or later.
### Workarounds
- Ensure the application is configured to validate the `InResponseTo` attribute (though patching is the only definitive fix).
- Limit network access to the SAML endpoints to trusted Identity Providers (IdP) if possible.
## Detection
- Monitor application logs for unusual successful logins from unexpected IP addresses.
- Audit account activity for administrative actions performed by users who do not typically perform such tasks.
- Inspect SAML assertions for missing or malformed `InResponseTo` fields or suspicious `Subject` identifiers.
## References
- Siemens Security Advisory: [https[:]//cert-portal[.]siemens[.]com/productcert/html/ssa-887643[.]html]
- Siemens CERT Services: [https[:]//www[.]siemens[.]com/en-us/content/cert-services/]
- Canadian Centre for Cyber Security Advisory: [https[:]//www[.]cyber[.]gc[.]ca/en/alerts-advisories/control-systems-siemens-security-advisory-av26-881]